io.github.chrischall/toasttab-mcp

Toast MCP

A Model Context Protocol server that connects Claude to the diner side of Toast. It finds restaurants that take orders through Toast and reads their menus, and, when you are signed in to toast.app, reads your own order history, loyalty programs and Toast Cash.

[!WARNING] AI-developed project. Claude Code built this codebase and maintains it, and no human has audited the implementation. Review the code and tool permissions before you use it.

What you can do

• "Which restaurants near me can I order takeout from on Toast right now?"
• "What's on the menu at https://order.toasttab.com/online/…? Anything vegetarian under $12?"
• "Is the oat-milk latte at that café out of stock today?"
• "Compare the online menu with the full in-store menu."
• "What did I order from that Thai place last week, and what did it cost?"
• "How close am I to a reward at my coffee shop? What's my Toast Cash balance?"

How it works

Toast's diner-facing sites (order.toasttab.com) and its ordering GraphQL gateway (ws-api.toasttab.com/do-federated-gateway) sit behind Cloudflare. Cloudflare refuses server-side clients: it serves a challenge page, or the gateway answers {"errors":[{"message":"Forbidden"}]}. This server therefore makes no direct requests. Every call goes through your own browser via the ContextMint Bridge extension, using @fetchproxy/server on 127.0.0.1:37149. You pass any "verify you are human" check yourself, in your own tab. Nothing is bypassed.

Tools

All of these tools are read-only. None of them places an order, touches a cart, redeems a reward or changes your account. The four account tools (toast_list_orders, toast_get_order, toast_get_loyalty, toast_get_wallet) work only while you are signed in to toast.app in the bridged browser.

What is verified and what isn't

The operations behind the dedicated tools (nearbyRestaurants, menusV3 and restaurantV2ByShortUrl) were live-verified on 2026-10-24 through a bridged browser. Menu prices are in dollars, and both TAKE_OUT and DELIVERY work. The gateway only answers requests that carry a guest session, which the server mints itself from an order.toasttab.com page through your browser, so you don't need to do anything beyond keeping that tab open.

The account tools run Toast's own guest-app queries (copied verbatim from toast.app's bundle), and every shape they parse was captured live and kept, scrubbed, as a test fixture. They authenticate with your toast.app access token, which the bridge reads from that one cookie for each call. The server never refreshes the token (refreshing rotates it and would sign your browser out), so if it has lapsed you'll be asked to reload toast.app. Saved payment methods and the account profile are deliberately not exposed.

Install

1. Install the ContextMint Bridge extension from its releases page. Chrome takes the unpacked zip.
2. Open any restaurant's ordering page on https://order.toasttab.com and leave the tab open. It relays the API calls. For the account tools, also keep a signed-in https://toast.app tab open.
3. Add the server to your MCP client:

{
  "mcpServers": {
    "toast": { "command": "npx", "args": ["-y", "toasttab-mcp"] }
  }
}

Node 22 or later is required. No credentials are configured here. On first run, the extension asks you to approve the pairing. It lists toasttab.com and toast.app, and a read of the toast-customer-access cookie for the account tools.

Configuration (all optional)

Troubleshooting

Run toast_healthcheck first.

• "Forbidden" or "edge … refused": your browser hasn't passed Toast's Cloudflare check yet. Open order.toasttab.com, let it load (complete any check), then retry.
• "No order.toasttab.com tab is open": open any order.toasttab.com/online/<restaurant> page in the browser that runs the extension.
• "not signed in" / "sign-in has expired" (account tools): open or reload toast.app and sign in, then retry.
• Directory comes back empty at night: nearbyRestaurants lists only restaurants open at when. Pass a daytime when.

Acknowledgement of terms

This server reaches Toast as you, through your browser, so Toast's guest terms of service govern how you use it. The maintainer has not reviewed those terms against this use. Read them yourself before you rely on this server. The project is not affiliated with or endorsed by Toast, Inc. It is for personal use: don't use it to bulk-harvest restaurant data.

Development

npm install
npm test        # typecheck + vitest (all mocked, no network)
npm run build   # typecheck + esbuild bundle → dist/bundle.js

License

MIT